Financial crisis anniversary Stock investor © Tom Grill Corbis

This week brings with it two rather bleak anniversaries. It has been 12 years since the Sept. 11, 2001, terrorist attacks and five years since Lehman Brothers filed for bankruptcy as part of the 2008 crisis that nearly brought the global financial system to its knees.

Along with remembrance, these milestones should bring a sense that we have learned enough to ensure that history doesn't repeat itself, or at least a sense that the pain and misery is receding.

In the case of the financial crisis, at least, I'm not sure that we can say so. For proof, look no further than JPMorgan Chase (JPM), which emerged from the crisis a big winner. The bank had sailed in to buy Bear Stearns and prevent its collapse in March 2008. That was hardly a public service (it gave JPMorgan a big boost in Wall Street league tables, and JPMorgan CEO Jamie Dimon picked up the assets for a song, with government help), but it may also have sent the wrong message to the rest of Wall Street that their own institutions would be too big to fail.

Be that as it may, JPMorgan Chase came through the crisis relatively stronger than it had been. But take a look at some of the comments and disclosures it made only this week, during a presentation to the Barclays Global Financial Services Conference in New York, and it becomes clear that five years after the crisis, we have yet to put many problems behind us.

And even the winners still have a lot to learn.

Wall Street remains full of supersize institutions

JPMorgan Chase is the biggest of these, and critics including Sheila Bair, former head of the Federal Deposit Insurance Corp., aren't at all confident that any of them have a good strategy for addressing the "too big to fail" conundrum. That means that if a future risk-management snafu or business misjudgment triggers the collapse of a big financial institution, we could be right back at square one.

While JPMorgan Chase CFO Marianne Lake bragged about the bank's giant market share and capital position at the Barclays conference, Bair's broader point is that that kind of market share brings systemic risk with it, and unless and until there's a workable "resolution" structure in place, the size of some of these institutions today is still worrying.

Nor do many of Wall Street's critics draw much comfort from the Federal Reserve's annual stress tests -- especially after the last one showed Citigroup (C) as being more resilient than JPMorgan.

"That's just downright odd," one analyst told me back in the spring, when those results were released.

Risk management remains imperfect

The financial crisis was a reminder of how often Wall Street failed to ask itself the most basic kind of question -- "What might go wrong here?" -- and failed to put in place systems that would increase the odds of identifying the biggest sources of risk before they morphed into large losses and write-downs.

Risk management -- which, after all, isn't a profit center but instead eats into returns on equity -- still isn't embedded in Wall Street DNA.

JPMorgan Chase is a great example of that, as the "London whale" trading losses reminded everyone last year. The bank's own reports on the problematic trades displayed myriad gaps in risk management, including evidence that some of the bank's managers manipulated internal risk models. Two of the directors who served on the bank's risk committee stepped down in July. JPMorgan Chase announced on Sept. 9 their replacements both have solid track records in finance; one of them, Linda Bammann, is a banking exec with risk management expertise.

But why wait five years to do this?

Mistakes continue, and continue to cost money

Government agencies have been busy filing lawsuits of all kinds against Wall Street institutions, many of them related to the way mortgage securities were originated, packaged, priced and sold before the crisis.

At JPMorgan Chase, the federal government and its agencies are conducting criminal investigations into the mortgage-backed securities operations as well as its energy-trading activities; other investigations target the London whale losses, the bank's credit card collections policies and activities and the way it handles mortgage foreclosures and guards against money-laundering.

Not all of these problems are historic in nature; the energy trading kerfuffle has surfaced only in the last year. New or old, the cost of defending against these allegations, paying fines to settle regulatory claims and providing against other penalties, is climbing.

Lake, the chief financial officer, told her conference audience on Sept. 9 that an increase to the bank's litigation reserve to address a "crescendo" of these actual and potential lawsuits will "more than offset" the $1.5 billion of consumer loan loss reserves that will be released as credit quality when the bank's loan portfolio has improved. "We are still finalizing the number," she said.

Some problems never disappear, they just metamorphose

Back in 2008, banks were stuck with big portfolios of mortgages, and especially low-quality "subprime" ones. They had been lending foolishly, assuming that they could always repackage those loans in such a way as to make them look appealing to someone out there.

Fast forward five years, and the mortgage arena once more is a problem area for banks such as JPMorgan Chase. This time it isn't a question of losses, but of revenue -- or rather, a steep decline in revenues from the home-lending business that the bank is likely to see as interest rates rise.

Lake said this week that mortgage-refinancing demand has fallen 60% from its peak in May, sooner and more rapidly than the bank had expected. Add that to competitive pressures and the time it takes to complete "taking expenses out of the system" (translation: eliminating some jobs in this part of the business) and profit margins here will be negative. At least this time, the mortgage business is likely to be only a drag on profits rather than a big question mark hanging over the future of the industry.

None of these are reasons to panic or to expect a re-run of the events of 2008. What is disconcerting, however, is the limited extent to which big financial institutions have changed the way they function in the wake of their near-death experience.

New regulations have been slow to emerge and have had unintended consequences; others haven't even materialized.

On the part of the banks themselves, a new mindset may be even further away today than it was in the autumn of 2008, when CEOs and CFOs were still scared silly by the narrowness of their escape from complete disaster.

Click here to become a fan of MSN Money on Facebook

More from The Fiscal Times: